WO2024244701A1 - Access control method implemented by means of hardware firewall, and hardware firewall in chip - Google Patents

Abstract

Provided in the embodiments of the present disclosure are an access control method implemented by means of a hardware firewall, and a hardware firewall in a chip. The method comprises: by means of a firewall filtering layer corresponding to an access end, receiving an access request which is initiated by the access end to an accessed end, wherein the access request carries a permissions identifier and an access address; according to the access address, determining a target access area from among a plurality of access areas of the accessed end corresponding to the firewall filtering layer; and according to the permissions identifier and the target access area, determining access permissions of the access request, wherein each access area is pre-configured with a mapping relationship between permissions identifiers for allowing access and corresponding access permissions.

Description

An access control method implemented by hardware firewall and an in-chip hardware firewall

CROSS-REFERENCE TO RELATED APPLICATIONS

This disclosure is based on Chinese patent application CN202310645888.3 filed on June 1, 2023, entitled “An access control method implemented by a hardware firewall and a hardware firewall in a chip”, and claims the priority of the patent application, and all the contents disclosed therein are incorporated into this disclosure by reference.

Technical Field

The present disclosure relates to the field of hardware firewalls, and in particular, to an access control method for a hardware firewall and an in-chip hardware firewall.

Background Art

As the integration and performance of smart chips become higher and higher, the security threats they face are becoming more and more serious. When using high-performance chips, attackers may use software and hardware methods to implant dangerous codes into modules in low-security functional areas, thereby launching attacks from low-function security areas to high-function areas when the chip is running, tampering with relevant information and permissions, and damaging chip functions. If the attack spreads to the car control area, it may cause serious personal safety and property losses.

Firewalls usually filter transmission information based on security policies. The use of software-level firewalls alone has the disadvantages of low information filtering efficiency, poor stability, incomplete protection capabilities, and heavy load on the central processing unit (CPU). By integrating hardware firewall functions in the chip, the information filtering capability can be effectively improved, the CPU burden can be reduced, and the intrusion detection and protection functions can be enhanced. However, the hardware firewall functions in most chips are relatively simple, mainly restricting the process of CPU access to memory, and have less access control for other access terminals such as graphics processing units (GPUs), video processing units (VPUs), and direct memory access (DMAs). There is no effect on the permission control of various peripherals of the chip except memory. The firewall is also relatively rough and simple in isolating memory information, divided into secure areas and non-secure areas, and has limited effect on the permission control and interactive functional security of areas with multiple security levels, resulting in the inability to guarantee the security level of each area.

In summary, a solution is urgently needed to address the problem that hardware firewalls in related technologies have single functions and limited authority control and functional security effects.

Summary of the invention

The embodiments of the present disclosure provide an access control method implemented by a hardware firewall and an in-chip hardware firewall, so as to at least solve the problem in the related art that the hardware firewall has simple functions and limited authority control and functional security effects.

According to an embodiment of the present disclosure, there is provided an access control method implemented by a hardware firewall, the method comprising: receiving an access request initiated by an access end to an accessed end through a firewall filtering layer corresponding to the access end, wherein the access request carries an authority identifier and an access address; determining a target access area from a plurality of access areas of the accessed end corresponding to the firewall filtering layer according to the access address; determining access rights of the access request according to the authority identifier and the target access area, wherein each access area is pre-configured with a mapping relationship between an authority identifier for allowed access and a corresponding access right.

According to another embodiment of the present disclosure, there is provided an in-chip hardware firewall, comprising: a plurality of firewall filter layers, wherein each firewall filter layer corresponds to one or more access terminals, each firewall filter layer corresponds to a plurality of access areas, each access area is pre-configured with a mapping relationship between a permission identifier for allowing access and a corresponding access permission; the firewall filter layer is configured to receive an access request for accessing an accessed terminal from the corresponding access terminal, and determine a target access area from the plurality of access areas of the corresponding accessed terminal according to the permission identifier and the access address carried in the access request, and determine the access permission of the access request according to the permission identifier and the target access area.

According to another embodiment of the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program executes the steps of any of the above method embodiments when executed by a processor.

According to another embodiment of the present disclosure, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a hardware structure block diagram of an access control method of a hardware firewall according to an embodiment of the present disclosure;

FIG2 is a flow chart of an access control method of a hardware firewall according to an embodiment of the present disclosure;

FIG3 is a schematic diagram of the structure of an automotive smart chip system according to an embodiment of the present disclosure;

FIG4 is a schematic diagram of a process of implementing access control through a page table in the related art;

FIG5 is a schematic diagram of a flow chart of access control when a page table is tampered with according to an embodiment of the present disclosure;

FIG6 is a schematic diagram of a process for implementing access control through a hardware firewall according to an embodiment of the present disclosure (I);

FIG7 is a schematic diagram of a process for implementing access control through a hardware firewall according to an embodiment of the present disclosure (II);

FIG8 is a schematic diagram of the structure of an on-chip hardware firewall according to an embodiment of the present disclosure;

9 is a schematic diagram of configuring multiple access terminal authority identifiers according to an embodiment of the present disclosure;

FIG. 10 is a schematic diagram of a detailed flow chart of firewall access control according to an embodiment of the present disclosure.

DETAILED DESCRIPTION

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

The method embodiments provided in the embodiments of the present disclosure can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a computer terminal as an example, FIG1 is a hardware structure block diagram of the access control method of the hardware firewall of the embodiment of the present disclosure. As shown in FIG1, the hardware board may include one or more (only one is shown in FIG1) processors 12 (the processor 12 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device) and a memory 14 for storing data, wherein the above-mentioned mobile terminal may also include a transmission device 16 and an input and output device 18 for communication functions. It can be understood by those skilled in the art that the structure shown in FIG1 is only for illustration and does not limit the structure of the above-mentioned mobile terminal. For example, the mobile terminal may also include more or fewer components than those shown in FIG1, or have a configuration different from that shown in FIG1.

The memory 14 may be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the access control method of the hardware firewall in the embodiment of the present disclosure. The processor 12 executes the computer program stored in the memory 14 to execute various functional applications and the access control method of the hardware firewall, that is, to implement the above method. The memory 14 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 14 may further include a memory remotely arranged relative to the processor 12, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

The transmission device 16 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider. In one example, the transmission device 16 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 16 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

In one embodiment of the present disclosure, a method for access control of a hardware firewall is provided. FIG. 2 is a flow chart of the method for access control of a hardware firewall according to an embodiment of the present disclosure. As shown in FIG. 2 , the process includes the following steps:

Step S202, receiving an access request initiated by the access end to the accessed end through the firewall filtering layer corresponding to the access end, wherein the access request carries an authority identifier and an access address;

Step S204, determining a target access area from a plurality of access areas of the accessed terminal corresponding to the firewall filtering layer according to the access address;

Step S206: determining the access rights of the access request according to the permission identifier and the target access area, wherein each access area is pre-configured with a mapping relationship between the permission identifier allowed to access and the corresponding access rights.

In the embodiment of the present disclosure, through steps S202 to S206, the problem of single hardware firewall function and limited authority control and functional security in related technologies can be solved. By setting authority identification and access areas to control the access end and the accessed end at the same time, the information security and functional security of the chip can be effectively improved, and the theft of sensitive information and authority control and intrusion into key security areas by external attacks can be reduced.

In an exemplary embodiment, before step S202, the filtering function of the firewall needs to be configured, which may specifically include the following steps:

Set the firewall filter layer corresponding to each device type according to the device type of the access end;

Configuring a plurality of access zones for each of the firewall filter layers, wherein the plurality of access zones have different address ranges;

A mapping relationship between an access permission identifier and the access permission is configured for each access area.

Furthermore, taking Double Data Rate SDRAM (DDR SDRAM for short) DDR memory as an example, DDR is the accessed end, and DDR can be divided into two parts: Region0 and Region1. Region0 has a high security level, and Region1 has a low security level, and is used for data sharing.

In the disclosed embodiments, by assigning memory access permissions and memory attributes to each area, user applications can be prevented from damaging data used by the operating system; untrusted applications can be prevented from accessing protected memory areas for the purpose of infringing intellectual property rights; memory areas can be defined as read-only to protect important data; abnormal access is blocked, and storage protection, peripheral protection, and privileged code access control protection are provided.

In an exemplary embodiment, each firewall can support 4 filter layers and 9 access regions, but the present disclosure is not limited thereto.

In an exemplary embodiment, step S204 may include the following steps:

Step S2042, matching the access address with the address range of each access area in the multiple access areas respectively;

Step S2044: determine an access area whose address range includes the access address as a target access area.

In an exemplary embodiment, step S204 may further include:

Step S2046, when the address ranges of the multiple access areas do not include the access address, a preset basic access area is determined as the target access area, wherein the basic access area is a part of the access area of the accessed end, and the basic access area is pre-configured with a mapping relationship between the permission identifier allowed to access and the corresponding access permission.

In an exemplary embodiment, step S206 may include: querying the pre-configured mapping relationship according to the target access area, and determining the access right corresponding to the permission identifier as the access right of the access request.

Furthermore, in the access area, only the permission identifiers for allowed access can be configured, or all IDs for allowed access and IDs for denied access can be configured. The access rights corresponding to the IDs for allowed access are read/write/read and write, and the access rights corresponding to the IDs for denied access are not read and write.

In another exemplary embodiment, the access request also carries the security attributes of the access terminal or service module. Further, step S206 may include the following steps:

Step S2062, when the security attribute is secure, determining that the access permission of the access request is a predetermined permission corresponding to the target access area;

Step S2064, when the security attribute is non-secure, query the pre-configured mapping relationship according to the target access area, and determine the access permission corresponding to the permission identifier as the access permission of the access request.

Furthermore, each access area can perform unified access control for access terminals (masters) with higher security levels. According to the security level of each access area, the corresponding predetermined permissions (i.e., the highest access permissions) can be set to non-readable, read-only, readable and writable, etc., which can more quickly determine access permissions and improve the response speed of access requests. For other non-secure access terminals/business modules, fine-grained control is performed through permission identification to ensure the security control effect.

Through the embodiments of the present disclosure, group control and granularity control methods can be supported, which can effectively reduce the complexity of authority control, improve the control accuracy of address ranges, and reduce resource usage.

In an exemplary embodiment, the method further comprises:

If the access permission of the access request is determined to be not readable or writable, denying the access request;

In a case where the access right of the access request is determined to be at least one of read or write, the access request is permitted.

In an exemplary embodiment, the access terminal includes one or more business modules; the access terminals and/or business modules with the same access rights have the same permission identifiers; the access terminals and/or business modules with different access rights have different permission identifiers.

Furthermore, in order to facilitate the management of access rights, a preset number of permission identifiers may be set. When the number of access terminals is less than the preset number, a different permission identifier may be assigned to each access terminal. However, when the number of access terminals is large, access terminals with the same security level or access rights may be grouped together, and a permission identifier may be assigned to each group. If an access terminal contains business modules with different security levels, a permission identifier needs to be configured for each business module.

In an exemplary embodiment, according to a preset security level specification, the chip system is divided into multiple preset functional safety level domains, wherein each functional safety level domain includes multiple access terminals and multiple accessed terminals; each functional safety level domain has a hardware firewall, wherein the hardware firewall is used to perform access control on the accessed terminals within the corresponding functional safety level domain; the permission identifier of the access terminal and/or business module is configured by the business module with the highest security level in the functional safety level domain.

Furthermore, taking the field of automotive smart chips as an example, the preset safety level specification can be the Automotive Safety Integration Level (ASIL).

In the embodiment of the present disclosure, a hardware firewall is configured for each functional safety level domain, and each hardware firewall is configured The mapping relationship between the access area (region) and identification (ID) of the software firewall and the corresponding access rights is configured to achieve hardware isolation and control of domains with different functional safety levels, thereby preventing high functional safety areas from being affected by low functional safety areas, and also preventing high functional safety services from being affected by low functional safety services.

In an exemplary embodiment, before step S204, the method further includes: converting the virtual address in the access request into a physical address through a page table in a memory management unit (Memory Management Unit, MMU) or a system memory management unit (System Memory Management Unit, SMMU), wherein the access address is a physical address.

In this embodiment, the MMU/SMMU can convert virtual addresses and physical addresses and control access through the page table. It maps virtual addresses of user state, kernel state, and peripherals respectively, converts them to corresponding physical addresses, and sets permission attributes in the page table to perform access control and regional isolation.

In an exemplary embodiment, the access end (master) may include at least one of the following: a central processing unit (CPU), a graphics processing unit (GPU), a video processor (VPU), a storage device, a neural network processor (NPU), a hardware security module (Hardware Security Module, HSM), a security encryption and decryption engine, a direct memory access (DMA), and an external device.

Furthermore, the access end may also include image signal processing (Image Signal Process, referred to as ISP), digital signal processing (Digital Signal Processing, referred to as DSP), and data processing unit (Data Process Unit, referred to as DPU)

In an exemplary embodiment, the accessed end may include at least one of the following: a storage device and a peripheral register.

In an exemplary embodiment, the hardware firewall may support a bypass debugging mode, and debug the system functions by bypassing the firewall, thereby reducing the complexity of troubleshooting;

In an exemplary embodiment, the hardware firewall can support an error reporting mechanism, and can report the error location and access information (address, attributes, etc.) in a timely and accurate manner to improve diagnostic efficiency. Furthermore, the firewall can also record and report rejected access requests so that users can promptly discover and handle potential risk issues.

Through the embodiments of the present disclosure, the functions of access control and permission setting can be achieved, and the problems in related technologies such as simple hardware firewall functions and limited permission control and functional safety effects can be solved. The permissions of different functional security level domains and secure/non-secure services can be accurately controlled, thereby improving the information security and functional safety of the entire chip system.

The disclosed embodiments can be applied to multifunctional high-performance integrated chips, especially in the field of chip security protection, including but not limited to cockpit chips, autonomous driving chips, mobile phone chips, computer chips, artificial intelligence chips, etc. Taking the field of automotive smart chips as an example, the current automotive smart chip systems mainly include digital instrument systems, assisted driving systems, and infotainment systems, etc., and different systems have different functions and security levels.

FIG3 is a schematic diagram of the structure of an automotive smart chip system according to an embodiment of the present disclosure. As shown in FIG3 , the automotive smart chip system can be divided into the following functional safety level domains according to functions and safety attributes:

High performance computing domain 32, automotive regulation domain (ASIL-B) 34, automotive regulation domain (ASIL-D) 36 and safety island (ASIL-D) 38.

In this embodiment, the high-performance computing domain 32 only involves information security, the automotive domain (ASIL-B), automotive domain (ASIL-D) and safety island (ASIL-D) involve functional safety, and the safety island (ASIL-D) has the highest safety level.

In this embodiment, each domain contains a high-computing CPU, GPU, storage device, NPU device, multi-channel display interface, and supports a variety of rich automotive peripherals, which can support 3D graphics display, deep learning, computer vision, audio and video encoding, etc. Decoding and other complex functions.

In this embodiment, the hardware of the high-performance computing domain 32 is a high-performance A-core processor and various peripheral modules. The A-core high-performance processor has a lower security level, but has relatively strong performance and computing power. It runs a high-performance operating system (HLOS) such as Linux or Android, which is mainly responsible for running high-computing functions such as entertainment systems, instrument displays, and environmental perception.

In this embodiment, the automotive domain (ASIL-B) 34 is composed of four real-time computing R cores, on which the FreeRTOS operating system runs, and is mainly responsible for sensor signal acquisition, body comfort system, regulatory control, air conditioning windows and suspension control and other functions.

In this embodiment, the automotive domain (ASIL-D) 36 uses two R cores for dual-core locking to achieve ASIL-D functional safety, and runs the automotive general control system AUTOSAR OS on it. It is mainly responsible for functions with particularly high safety requirements, such as vehicle control, power control, energy management, and chassis functions.

In this embodiment, the safety island (ASIL-D) 38 also uses two R cores for dual-core locking to achieve ASIL-D functions. All its system components are independent of other domains and are not affected by the functions of other domains. It mainly performs safety monitoring and key data storage.

Applying the access control method in any of the above application embodiments to the automotive smart chip system can ensure that each domain does not affect each other's functional safety level during the interaction process. By setting the permission identification (ID) and access rights, the high-performance computing domain can be controlled not to affect the functional safety area, and the low-functional safety domain can access the high-functional safety domain, allowing reading but not writing. Furthermore, if reading will cause other side effects, such as reading the first-in-first-out queue (First In First Out, referred to as FIFO), access should be prohibited. At the same time, the services within the same functional safety domain can be distinguished, and isolation can be achieved between low-functional safety services and high-functional safety services.

FIG4 is a flow chart of implementing access control through page tables in the related art. As shown in FIG4, MMU/SMMU converts virtual addresses and physical addresses and performs access control through page tables. It maps virtual addresses such as user state, kernel state, and peripherals, converts them to corresponding physical addresses, and sets permission attributes in the page table to perform access control and regional isolation.

Furthermore, the memory and page table are managed by the operating system (OS) running on the A core, and the access scope and permission control of the access source are completed by the OS operating the page table, including the page table of MMU and SMMU. The page table is stored in DDR, and the cache storing the page table in MMU is the translation look-aside buffer (TLB). The page table control permissions include data read, write, and executable. The first two correspond to the data path, and the latter corresponds to the instruction path.

FIG5 is a flowchart of access control when the page table is tampered with according to an embodiment of the present disclosure. As shown in FIG5 , the left side is an example of directly accessing the memory after querying the page table, and the right side is an example of accessing the memory through the firewall after querying the page table.

In this embodiment, when the page table function is normal and has not been tampered with, when the non-secure access end (master) accesses the memory, it will first use the MMU to query the page table. If the access address is in the non-secure area, the MMU will convert the virtual address into a physical address to access the data in the non-secure area of the memory. If the access address is in the secure area, the MMU will deny the non-secure access end access according to the page table permission attributes, thereby completing the access isolation between the secure area and the non-secure area.

In this embodiment, when the MMU/SMMU page table permissions are illegally tampered with, if the memory is directly accessed after querying the page table, the non-secure access end can access the secure data in the DDR through the tampered page table, thereby bringing security risks.

In this embodiment, if a firewall is used to perform access filtering on the DDR interface, for a non-secure access end, even if the page table is illegally tampered with, its access to secure data will still be blocked, and it can only access specific areas to which it has permission.

Through the embodiments of the present disclosure, data security protection is further strengthened from the accessed end, which can avoid data transfer process. (For example, the page table is illegally tampered with) resulting in security risks.

Figure 6 is a schematic diagram of a process of implementing access control through a hardware firewall according to an embodiment of the present disclosure (I), which is applied to a high-performance computing domain. As shown in Figure 6, within the high-performance computing domain (core A), the firewall can perform permission control on the process of different access terminals accessing the computing domain DDR.

In this embodiment, the access end in the high-performance computing domain includes: A core processor, secure OS, non-secure OS, hardware security module HSM, encryption and decryption engine, direct memory access DMA; the accessed end includes DDR and peripherals.

In this embodiment, the memory DDR is divided into a secure access area (region) and a non-secure access area by a firewall, thereby achieving physical isolation of secure data and non-secure data.

Furthermore, the memory DDR can be divided into multiple access regions with different security levels, and distinguished by numbers "region+number", wherein region0 can be a preset basic access region. The present disclosure does not limit the number of access regions.

In this embodiment, the A core processor has two states: secure state and non-secure state, namely secure OS and non-secure OS. The secure state can access the entire DDR data, while the non-secure state can only access non-secure data and is prohibited from reading and writing secure data.

In this embodiment, security modules such as the hardware security module HSM and the encryption and decryption engine are mainly responsible for high-security information and encryption and decryption services. They have a high security level and can access the entire DDR data normally. Non-security modules such as DMA are mainly responsible for moving data and can only operate on non-security data. Reading and writing of security data is prohibited.

In the disclosed embodiments, the information security within the high-performance computing domain can be protected by a hardware firewall, ensuring that secure data cannot be obtained/destroyed by non-secure access terminals.

Figure 7 is a schematic diagram of the process of implementing access control through a hardware firewall according to an embodiment of the present disclosure (II), which is applied to the high-performance computing domain and the automotive domain (ASIL-B). As shown in Figure 7, the firewall read and write permission control during the process of the high-performance computing domain (A core) and the automotive domain (R core) accessing the DDR in the automotive domain (ASIL-B) at the same time.

In this embodiment, a hardware firewall is provided in each of the high-performance computing domain and the automotive domain (ASIL-B) for performing access control on the accessed end in the current domain.

In this embodiment, the DDR in the automotive domain (ASIL-B) is divided into two parts, Region 0 has a high security level, and Region 1 has a low security level, which is used for data sharing. However, the present disclosure is not limited to this, and the number of access areas and the corresponding security level can be adjusted according to actual needs.

In this embodiment, when core A and DMA in the high-performance computing domain access the memory of the automotive domain (ASIL-B), the firewall will control the access area and permissions based on the access source. Since the security level of core A is lower than that of the automotive domain, the firewall can be configured as follows: core A can only read Region0 and cannot write to Region0, but can freely read and write Region1, which facilitates data interaction with core R.

In this embodiment, when the R core accesses the vehicle-specification domain memory, it can freely read and write Region0 and Region1 because the safety level is ASIL-B and meets the requirements.

In another exemplary embodiment, memory access by an R core in the automotive domain (ASIL-B) to a higher level safety domain (such as the automotive domain ASIL-D) is restricted by a firewall within the automotive domain (ASIL-D).

Furthermore, the firewall is controlled according to the permission identification (ID) of the access source, which can be achieved by setting different permission tags for the A core and the R core.

In the disclosed embodiments, hardware isolation of domains with different functional safety levels can be achieved through a hardware firewall, thereby ensuring functional safety, that is, areas with high functional safety cannot be affected by areas with low functional safety, and areas with functional safety cannot be affected by computing domains.

FIG8 is a schematic diagram of the structure of an on-chip hardware firewall according to an embodiment of the present disclosure.

As shown in FIG8 , the hardware firewall in the chip includes: multiple firewall filter layers (Filter0 to Filter3). Each firewall filter layer corresponds to a different type of access terminal. For example, the firewall filter layer corresponding to the CPU is Filter0, the firewall filter layer corresponding to the GPU is Filter1, the firewall filter layer corresponding to the DMA/DPC is Filter2, and Filter3 is not shown. The present disclosure is not limited to this, and the number of firewalls and the corresponding access terminal types can be adjusted according to actual needs.

In this embodiment, each firewall filter layer corresponds to one or more access terminals, each of the firewall filter layers corresponds to multiple access areas, and each of the access areas is pre-configured with a mapping relationship between a permission identifier for allowed access and corresponding access rights.

In this embodiment, the firewall filtering layer is configured to receive an access request for accessing the accessed end from the corresponding access end, and determine a target access area from multiple access areas of the corresponding accessed end based on the permission identifier and access address carried in the access request, and determine the access rights of the access request based on the permission identifier and the target access area.

Furthermore, each access area corresponds to an address range of the accessed end (such as DDR memory), and the address ranges corresponding to the access areas in different firewall filtering layers may overlap. For example, region1 and region3 in Figure 8 correspond to the DDR address range of area A1 to A2.

In an exemplary embodiment, the firewall can be set to support 4 filter layers (Filter) and 9 access areas (regions). The Filter external access terminal (master), such as CPU, GPU, DPC, VPU, etc., can confirm whether it can read and write the corresponding access area based on the access address and ID.

In an exemplary embodiment, a common basic access area (such as region 0) can be set for multiple firewall filter layers, and addresses that are not in the range of Region 1 to Region 8 belong to region 0. Further, the basic access area can be set to the lowest authority, retaining only the read and write authority of the data sharing area, but the present disclosure is not limited to this, and the authority content can be adjusted according to actual needs.

In an exemplary embodiment, a hardware firewall is located between an accessed end and a network on chip (Network On Chip, NoC for short); the hardware firewall and the accessed end are in the same functional safety level domain, and the functional safety level domain is divided according to a preset security level specification.

Furthermore, a firewall filter layer can be set at the interface of the memory DDR. The on-chip network will send the access request to the firewall filter layer corresponding to the access end according to the device type of the access end, and control and filter the access rights through the firewall filter layer.

In an exemplary embodiment, the firewall filtering layer further includes: an access register configured to store mapping relationships between corresponding permission identifiers and access permissions allowed in the multiple access areas, respectively.

In an exemplary embodiment, if a region is to restrict access to a certain ID and deny access to other IDs, the region must cross all valid filters. Each region can control all 16 IDs.

Furthermore, if the number of access terminals is greater than a preset number, such as 16, multiple access terminals with the same authority can share one ID. Access terminals with the same ID can be divided into different filtering layers according to device type.

In an exemplary embodiment, access can be divided into secure access and non-secure access, and its security attributes are determined by the access end or business module that initiates the access request. Generally, the firewall controls the permission of secure access as read/write; for non-secure access, it is necessary to further control the permission as read/write based on the ID.

In an exemplary embodiment, the ID of each access terminal is software configurable, that is, it can be statically configured when the system starts.

Figure 9 is a schematic diagram of configuring multiple access terminal authority identifiers according to an embodiment of the present disclosure. As shown in Figure 9, the authority identifier (ID) of the access terminal in each functional security level domain is configured by the business module with the highest security level in the domain, namely the IDs_conf module.

In an exemplary embodiment, the entire system is divided into two parts: a high-performance computing domain (on the left) and an automotive-regulatory domain (on the right). A set of registers is set in each functional safety level domain to configure the IDs of all access terminals/business modules in the area.

Furthermore, in the high-performance computing domain, it can be configured by a hardware security module HSM with high security functions, and in the automotive domain, it can be configured by an R-core processor. This configuration is relatively flexible and versatile.

In an exemplary embodiment, the ID configuration of the high-performance computing domain (left) mainly involves information security, such as GPU, VPU, DMA, etc., and its ID can generally be determined before leaving the factory. The automotive domain (right) has high security requirements and mainly involves functional safety. The services of the access end include security and non-security services, and the services of different manufacturers are not the same. Therefore, the ID of the automotive domain does not need to be fixed and can be statically configured when the system starts.

In an exemplary embodiment, when the number of access terminals/business modules that require ID configuration is small, each module can be configured with a different ID. When there are many modules that require ID configuration, a group control method can be used to configure the same ID for business modules with the same access rights, thereby reducing the complexity of access control and permission determination.

FIG10 is a detailed flow diagram of firewall access control according to an embodiment of the present disclosure. As shown in FIG10 , the flow includes the following steps:

Step S1001, for each access request coming in through the Filter, the address is compared starting from Region 1. If the address is located in the Region and the Region is valid in the current Filter, the next step is started.

Step S1002, if Region 1 does not match, then M+1, compare the next Region, and cycle in sequence. If all Regions cannot match, use Region 0 to control the permission of the Filter.

Step S1003, determine the security attribute of the access, if it is a secure state, read the access register of the region to check whether the current access is allowed, where 1 is allowed and 0 is denied.

Step S1004, if it is a non-secure access, determine whether the ID of the access source is configured in the region according to the access register of the region. If configured, further check the access rights of the ID, whether it is read/write or read-write.

In an exemplary embodiment, step S1001 and step S1002 can also specifically match the Region configured in the Filter. If no Region is matched, the basic access area (Region 0) is used for permission control.

In this embodiment, the access register in step S1004 is configured only for the ID that is allowed to access the access area, and when the ID is not configured in the access area, the access request is rejected.

Through the disclosed embodiments, it is possible to filter the information of the accessed end, ensure the data security of key security areas, and prevent access rights from being tampered with. Fine-grained access control can be achieved through the combination of ID and Region, which can more safely and effectively protect access areas of different security levels.

An embodiment of the present disclosure further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above method embodiments are executed.

In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to: a USB flash drive, a read-only storage medium, Various media that can store computer programs include Read-Only Memory (ROM), Random Access Memory (RAM), mobile hard disk, magnetic disk or CD, etc.

An embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

In an exemplary embodiment, the electronic device may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

Obviously, those skilled in the art should understand that the above modules or steps of the present disclosure can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present disclosure is not limited to any specific combination of hardware and software.

The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims (16)

An access control method implemented by a hardware firewall, the method comprising: Receiving, through a firewall filtering layer corresponding to the access end, an access request initiated by the access end to the accessed end, wherein the access request carries an authority identifier and an access address; Determine a target access area from a plurality of access areas of the accessed end corresponding to the firewall filtering layer according to the access address; The access permission of the access request is determined according to the permission identifier and the target access area, wherein each access area is pre-configured with a mapping relationship between the permission identifier allowed to access and the corresponding access permission. The method according to claim 1, wherein before receiving, through a firewall filtering layer corresponding to the access terminal, an access request initiated by the access terminal to the accessed terminal, the method further comprises: Set the firewall filter layer corresponding to each device type according to the device type of the access end; Configuring a plurality of access zones for each of the firewall filter layers, wherein the plurality of access zones have different address ranges; A mapping relationship between an access permission identifier and the access permission is configured for each access area. The method according to claim 1, wherein determining the target access area from a plurality of access areas corresponding to the firewall filtering layer according to the access address comprises: matching the access address with the address range of each access area in the plurality of access areas respectively; An access area whose address range includes the access address is determined as a target access area. The method according to claim 3, further comprising: When the address ranges of the multiple access areas do not include the access address, a preset basic access area is determined as the target access area, wherein the basic access area is a part of the access area of the accessed end, and the basic access area is pre-configured with a mapping relationship between the permission identifier allowed to access and the corresponding access permission. The method according to claim 1, wherein determining the access rights of the access request according to the permission identifier and the target access area comprises: The pre-configured mapping relationship is queried according to the target access area, and the access permission corresponding to the permission identifier is determined as the access permission of the access request. The method according to claim 1, wherein determining the access rights of the access request according to the permission identifier and the target access area comprises: The access request also carries the security attributes of the access terminal or service module; In a case where the security attribute is secure, determining that the access permission of the access request is a predetermined permission corresponding to the target access area; In the case where the security attribute is non-secure, the pre-configured mapping relationship is queried according to the target access area, and the access permission corresponding to the permission identifier is determined as the access permission of the access request. The method according to claim 1, further comprising: If the access permission of the access request is determined to be not readable or writable, denying the access request; In a case where the access right of the access request is determined to be at least one of read or write, the access request is permitted. The method according to claim 1, wherein The access terminal includes one or more service modules; The access terminals and/or business modules with the same access rights have the same permission identifiers; Access terminals and/or business modules with different access rights have different corresponding permission identifiers. The method according to claim 8, wherein According to the preset safety level specification, the chip system is divided into a plurality of preset functional safety level domains, wherein each functional safety level domain includes a plurality of access terminals and a plurality of accessed terminals; Each functional safety level domain has a hardware firewall, wherein the hardware firewall is used to perform access control on the accessed end within the corresponding functional safety level domain; The permission identifier of the access terminal and/or business module is configured by the business module with the highest security level in the functional security level domain. The method according to claim 1, wherein, before determining the access rights of the access request according to the permission identifier and the target access area, the method further comprises: The virtual address in the access request is converted into a physical address through a page table in a memory management unit MMU or a system management unit SMMU, wherein the access address is a physical address. The method according to any one of claims 1 to 10, wherein The access end includes at least one of the following: a central processing unit CPU, a graphics processing unit GPU, a video processing unit VPU, a storage device, a neural network processor NPU, a hardware security module HSM, a security encryption and decryption engine, a direct memory access DMA and an external device; The accessed end includes at least one of the following: a storage device and a peripheral register. An in-chip hardware firewall, comprising: Multiple firewall filter layers, wherein each of the firewall filter layers corresponds to one or more access terminals, each of the firewall filter layers corresponds to multiple access areas, and each of the access areas is pre-configured with a mapping relationship between a permission identifier allowed to access and a corresponding access permission; The firewall filtering layer is configured to receive an access request for accessing the accessed end from the corresponding access end, and determine a target access area from multiple access areas of the corresponding accessed end according to the permission identifier and access address carried in the access request, and determine the access rights of the access request according to the permission identifier and the target access area. The hardware firewall according to claim 12, wherein: The hardware firewall is located between the accessed end and the on-chip network; The hardware firewall and the accessed end are in the same functional safety level domain, and the functional safety level domain is divided according to a preset security level specification. The hardware firewall according to claim 12, wherein the firewall filtering layer further comprises: The access register is configured to store the mapping relationship between the corresponding permission identifiers and access permissions of the multiple access areas. A computer-readable storage medium, wherein a computer program is stored in the storage medium, wherein the computer program executes the method described in any one of claims 1 to 11 when executed by a processor. An electronic device comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the method according to any one of claims 1 to 11.